Skip to contentSkip to conversation

Using OneRNG hardware RNG can I get wireguard to use /dev/random

DISCUSSION peter garner 4 participants 4 messages Jul 24, 2020

lore
Share & tools
lore

peter garner

author
#0 lore raw

Hi List,

Platform: Raspberry Pi4B, Raspbian Buster 10. This device dedicated to wireguard. uname -a: Linux wireguard 4.19.118-v7l+ #1311 SMP Mon Apr 27 14:26:42 BST 2020 armv7l GNU/Linux. wg-quick is dated May 22 08:11

I've used my OneRNG v3.0 external device to recreate my SSH moduli and am now looking to recreate my wireguard keys.

According to the Wireguard docs it uses /dev/urandom:
https://gist.github.com​/rmoriz​/58f1768218a4fbc4b318615bfb85111d

fd = open("/dev/urandom", O_RDONLY);
	if (fd < 0)
		return fd;
	ret = read(fd, out, len);
	close(fd);

The OneRNG utilises /dev/random though - is there any way I can get wireguard to use /dev/random instead (without recompiling) ?

#1 lore raw
Quoted 4 lines · peter garner

I've used my OneRNG v3.0 external device to recreate my SSH moduli and am now looking to recreate my wireguard keys.

Quoted 8 lines

According to the Wireguard docs it uses /dev/urandom:
https://gist.github.com/rmoriz/58f1768218a4fbc4b318615bfb85111d

fd = open("/dev/urandom", O_RDONLY);
        if (fd < 0)
                return fd;
        ret = read(fd, out, len);
        close(fd);

Unrelated, the kernel-crypto folks recommend using /dev/urandom. Wiregaurd is following best practices. Also see
https://lkml.org/lkml/2017/7/20/993.

Jeff

#2 lore raw
Quoted 14 lines
Quoted 8 lines · Jeffrey Walton

On Fri, Jul 24, 2020 at 4:28 AM peter garner <[email protected]> wrote:
I've used my OneRNG v3.0 external device to recreate my SSH moduli and am now looking to recreate my wireguard keys.
According to the Wireguard docs it uses /dev/urandom:
https://gist.github.com/rmoriz/58f1768218a4fbc4b318615bfb85111d

Quoted 5 lines
fd = open("/dev/urandom", O_RDONLY);
      if (fd < 0)
              return fd;
      ret = read(fd, out, len);
      close(fd);
Quoted 5 lines

Unrelated, the kernel-crypto folks recommend using /dev/urandom. Wiregaurd is following best practices. Also see
https://lkml.org/lkml/2017/7/20/993.

Jeff

Thanks Jeff - all is now clear (that link helped as well). I've been doing some additional research and everything makes sense.

#3 lore raw
In reply to peter garner
Quoted 13 lines · peter garner

Hi List,

Platform: Raspberry Pi4B, Raspbian Buster 10. This device dedicated to wireguard. uname -a: Linux wireguard 4.19.118-v7l+ #1311 SMP Mon Apr 27 14:26:42 BST 2020 armv7l GNU/Linux. wg-quick is dated May 22 08:11

I've used my OneRNG v3.0 external device to recreate my SSH moduli and am now looking to recreate my wireguard keys.

According to the Wireguard docs it uses /dev/urandom:
https://gist.github.com/rmoriz/58f1768218a4fbc4b318615bfb85111d

Quoted 8 lines
fd = open("/dev/urandom", O_RDONLY);
        if (fd < 0)
                return fd;
        ret = read(fd, out, len);
        close(fd);

The OneRNG utilises /dev/random though - is there any way I can get wireguard to use /dev/random instead (without recompiling) ?

We're not going to change the wireguard-tools source for this.

But if you need to hijynx it, just use mknod to make /dev/urandom point to the same device node as /dev/random. I'd recommend finding a better solution, however, to whatever randomness situation you have going on.